Hacker News Reader

Comment by teruakohatu | Hacker News Reader

This is a real shame.

BLE and ANT+ are fundamentally different, the latter being a broadcast protocol. You can have any number of devices connected/logging the broadcast of an ANT+ device, while BLE is usually limited to one or two devices. I am sure is not a fundamental limitation of BLE but is the reality for the currently available chipsets.

The fact that it is unencrypted is completely irrelevant.

My heart rate data over a short period of time is not useful to anyone but myself, and that is the only personal data any of my ANT+ devices broadcast.

Unless you consider cadence to be personal information but that is also broadcasted to the world visually and is no more secret than the colour of my running or cycling shorts.

The rest of my devices broadcast mechanical, device status and/or environmental data.

View on HN

Ant also broadcasts a unique(-ish) identifier. This was enough to end Nike+. https://en.wikipedia.org/wiki/Nike%2BiPod#Wireless_protocol_...

Ok, I know this doesn't make much sense with relation to ANT+ or heart rate stuff but...

I read recently that the bluetooth standard was getting a broadcast protocol.

this seems like a no-brainer, think of uses like museums or movie theaters, let alone your television

EDIT: it is public broadcast protocol PBP

EDIT2: wasn't the protocol used in gyms anyway not ANT+ but the protocol developed by polar?

> I am sure is not a fundamental but is the reality for the currently available chipsets.

It is pretty fundamental. Ant has an inverted master/slave (or whatever we're calling it nowdays) relationship. In Ant, the sensor determines the timing, and can broadcast to many receivers. In Bluetooth, the central device (phone) determines the timing, and each sensor connects to one central with a one-to-one connection.

There are ways around this limitation of BLE:

1. A few bytes of data can be stuffed in BLE advertising, so the sensor can communicate without a connection in the Ant style. To my knowledge, none of the Ant+-replacing profiles support this.

2. The sensor can basically run multiple instances of bluetooth stack at the same time to connect to multiple central devices. This basically doubles the resource usage, and good luck determining if your sensor supports this without trying it.

#2 appears to be the path forward. A few sensors support it already, and the next generation of radio SOCs will make the resource requirements less onerous.

Maybe encryption isn't important for you, but it is for some people, especially professional athletes. Imagine a Tour De France rider or their follow car being able to read the heart rate of their competitor - this could easily inform their strategy.

We're really going to screw things up for everyone else because of a couple dozen professional bike racers? This deal sucks

Are we really going to argue in 2025 that encryption is too hard?

We are really going to argue in 2025 that encryption is too hard when you want a cheap, tiny sensor to operate for months on a single CR2032 battery.

So like my wireless shifters whose battery I haven’t changed in over a year.

Wireless shifters only transmit when you press a button. Power consumption is higher with other sensors that transmit continuously at 1Hz: heart rate, running foot pods, wheel speed, cadence, etc.

Exactly. Transmitting over radio continuously is what is expensive, not encrypting a couple of bytes.

> tiny sensor to operate for months on a single CR2032 battery.

Not to mention real-time broadcasting of sensor data to multiple devices.

In the case of HR data: ~1 update per second which is usually broadcasted three times in succession to ensure transmission)

I'd want to see actual numbers.

Radio transmit is expensive power-wise. The numbers I'm seeing for BLE energy per bit are all over the place, but the numbers I found for some SHA3 testing say that even with a pretty old chip fab you can make a circuit that encrypts more than 10 bytes per nanojoule. That's a pretty small tax.

Good handshakes are actually hard. There's no UI on these gadgets, and often not even a single button! Consider going to a public gym and wanting your heartrate to show on the exercise bike -- you'll be pairing it right there, in public.

Reducing the risk to handshake is already pretty good, but also that's going to be quite hard to MitM. Just use diffie-hellman.

If they care about that kind of privacy why would they not buy a device that has encryption for the broadcasting?

If this scenario is relevant for anyone, it's a tiny number of people. That leaves 99.99% of the fitness market.

It's health and presence info. In surveillance capitalism your or your flat neighbour's devices might capture it, upload to cloud and sell it, the buyer of the info might combine it with location data etc to bind it to your identity, and sell it onwards.

The next time you buy health insurance or are involved in a court case the data may be used against your interests. (probably someone can invent a still more nefarious scenario)

Imagine a Tour de France team who spends millions of dollars being unwilling to find a company to build them a custom monitor that supports heart rate monitoring with an encrypted data stream if they can’t find one off the shelf.

30 seconds of searching shows me the polar h10 is already multiprotocol and supports Bluetooth.

https://www.polar.com/us-en/sensors/h10-heart-rate-sensor/

The Polar H10 broadcasts your heart rate unencrypted in ADV_IND frames last time I checked.

It seems that pro cycling teams aren't actually very concerned about this.

https://www.facebook.com/dcrainmaker/posts/pfbid02doLyLhNSwT...

Reply on news.ycombinator.com